PT-2017-6635 · Beaker · Beaker

Dan Callaghan · Publicado 2017-09-06 · Atualizado 2017-09-10 · CVE-2015-3161

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Beaker versions prior to 20.1

Description The issue concerns the search bar code in the bkr/server/widgets.py file, which fails to escape tags in string literals when producing JSON. This could potentially lead to security issues.

Recommendations For versions prior to 20.1, update to version 20.1 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-3161

Produtos afetados

Beaker

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-3161 · Nota de Segurança
• https://bugzilla.redhat.com/attachment.cgi?id=1020004 · Correção
• https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1215024 · Correção
• http://openwall.com/lists/oss-security/2015/05/08/1 · Nota
• http://securityfocus.com/bid/74574 · Nota